7.2

CVE-2023-23355

An OS command injection vulnerability has been reported to affect QNAP operating systems. If exploited, the vulnerability possibly allows remote authenticated administrators to execute commands via unspecified vectors.
QES is not affected.

We have already fixed the vulnerability in the following versions:
QTS 5.0.1.2346 build 20230322 and later
QTS 4.5.4.2374 build 20230416 and later
QuTS hero h5.0.1.2348 build 20230324 and later
QuTS hero h4.5.4.2374 build 20230417 and later
QuTScloud c5.0.1.2374 and later

Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Qnap ≫ Qvr Version-
Qnap ≫ Qts Version < 5.0.1.2346
Qnap ≫ Quts Hero Version < h5.0.1.2348
Qnap ≫ Qutscloud Version-
Qnap ≫ Qvp-41b Firmware Version-
   Qnap ≫ Qvp-41b Version-
Qnap ≫ Qvp-63b Firmware Version-
   Qnap ≫ Qvp-63b Version-
Qnap ≫ Qvp-85b Firmware Version-
   Qnap ≫ Qvp-85b Version-
Qnap ≫ Qvp-21a Firmware Version-
   Qnap ≫ Qvp-21a Version-
Qnap ≫ Qvp-41a Firmware Version-
   Qnap ≫ Qvp-41a Version-
Qnap ≫ Qvp-63a Firmware Version-
   Qnap ≫ Qvp-63a Version-
Qnap ≫ Qvp-85a Firmware Version-
   Qnap ≫ Qvp-85a Version-
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.33% 0.529
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 7.2 1.2 5.9
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
security@qnapsecurity.com.tw 6.6 2.3 3.7
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L
CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection')

The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.

CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.